topic Re: Skype IM Problem in General Topics

Skype IM Problem

diennea — Tue, 06 Nov 2012 11:09:05 GMT

Hi,

I've some problems with skype instant messaging.

Sometimes the messages are not sent.

Checking firewall logs I see when messages are not sent an 'unknown-tcp' connection is denied.

Same destination port (but different ip) were used and recognized before as 'skype' connection

For example

Time	App	From	Src Port Source
Rule	Action	To	Dst Port Destination
	Src User	Dst User

===============================================================================

2012/11/06 11:19:26 skype	Zone1 52682	192.168.xxx.xxx
Skype	allow	Zone2	12350	78.141.179.16
	user1

2012/11/06 11:19:56 unknown-tcp	Zone1 49727	192.168.xxx.xxx
blocca_navigazione deny	Zone2 12350	78.141.179.12
	user1

It seems that PAN-OS was not able to identify correctly the connection.

For security reasons I cannot open 'unknown-tcp' connection.

Any solutions?

Firewall PAN-500

OS: 4.1.7

Application and threat: 336-1565 2012-10-30

Thanks

Regards

Re: Skype IM Problem

mikand — Tue, 06 Nov 2012 12:04:10 GMT

I wonder if the dependency fixes in PANOS 5.0 would help you or not.

I mean this way only enough traffic to identify what you have set to allow will be able to pass through.

In this particular case this would hopefully mean that "unknown-tcp" would be allowed for x packets going from this particular client towards wathever ip/port the signature for skype in appid uses (compared to today where you basically must allow "unknown-tcp" statically with srcip:any dstip:any unless you want stuff like this to be blocked).

By the way, did you already enable skype-probe?

Re: Skype IM Problem

diennea — Tue, 06 Nov 2012 13:42:55 GMT

Hi,

skype-probe is enable.

Now I'm testing a new rule for this user.

I'm allowing "skype", "skype-probe", "unknown-tcp" and "unknown-udp" from "test-user" to any (any ports).

Probably it will works but problem is that I want keep blocked "unknown-tcp" from any to any...

Do you know if PAN OS 5.0 will solve this problem? When will the new version?

Thanks

Regards

Re: Skype IM Problem

kfindlen — Tue, 06 Nov 2012 19:05:53 GMT

Hi Mauro,

If you still see Skype traffic being classified incorrectly I would suggest opening a support case so we can investigate. We will likely need a client PCAP and the show session output showing the problem sessions but we should be able to add it to the application.

Thanks,

-- Kevin

Re: Skype IM Problem

diennea — Thu, 08 Nov 2012 15:23:40 GMT

Hi,

after I allowed "skype", "skype-probe", "unknown-tcp" and "unknown-udp" from "test-user" to any (any ports) everything works fine.

I see "unknow-tcp" traffic so problem is that some skype packets are not correctly recognized.

I will open a support case

Re: Skype IM Problem

essnet — Thu, 08 Nov 2012 15:29:30 GMT

Also keep in my mind that Skype is one the of the most tricky and hiding application and it changes often. The fact it's seen as unknown-tcp is not surprise and can't blame PAN for this.

Skype should document their product and stop playing cat and mouse game if they don't want to be purely blocked in all big corp networks.

Re: Skype IM Problem

diennea — Thu, 08 Nov 2012 15:40:48 GMT

I know Skype changes very often and I understand that it shouldn't be simple for PAN.

I think problem is that sometimes destination IP changes.

I paste again my above example:

Time	App	From	Src Port Source
Rule	Action	To	Dst Port Destination
	Src User	Dst User

===============================================================================

2012/11/06 11:19:26 skype	Zone1 52682	192.168.xxx.xxx
Skype	allow	Zone2	12350	78.141.179.16
	user1

2012/11/06 11:19:56 unknown-tcp	Zone1 49727	192.168.xxx.xxx
blocca_navigazione deny	Zone2 12350	78.141.179.12
	user1

As you can see in the first line the IP was 78.141.179.16 (destination port 12350 ) while in the second line IP was 78.141.179.12 (same destination port)...

By the way...

Yesterday PAN sent

Application and Threat Content Release Notes

Version 337

Modified Applications (7)

Risk	Name	Category	Subcategory	Technology	Depends on	Minimum Version
4	flash	general-internet	internet-utility	browser-based	web-browsing	3.1.0
3	hotspot-shield	networking	encrypted-tunnel	client-server	ssl,web-browsing	3.1.0
5	nntp	general-internet	internet-utility	client-server		3.1.0
1	pcoip	networking	remote-access	client-server		3.1.0
2	securid	business-systems	auth-service	client-server		3.1.0
4	skydrive(function)	general-internet	file-sharing	browser-based	live-mesh,ssl,web-browsing	3.0.0
5	skype	collaboration	voip-video	peer-to-peer	web-browsing	3.1.0

Skype application changed.

Do you know if PAN solved this problem?

Thanks

Regards

Re: Skype IM Problem

essnet — Thu, 08 Nov 2012 15:45:33 GMT

IPs will change all time : Skype is not a centralized system , a client (you for example) can become a proxy for other clients, like a peer to peer program. Same when you chat / video call, it's a peer to peer communication.

Also you can revert to the old signature package and see if it solves your problems.

Re: Skype IM Problem

diennea — Thu, 08 Nov 2012 15:48:33 GMT

So you think this cannot be the problem, don't you?

Re: Skype IM Problem

essnet — Thu, 08 Nov 2012 15:49:52 GMT

That's my opinion: Destination IP and ports cannot be the problem as Skype is peer to peer enabled it doesn't rely on a pre-known list of servers.

Re: Skype IM Problem

essnet — Thu, 08 Nov 2012 15:51:58 GMT

Try to revert to an old signature package (you were suggesting this is happening since version 337)

Re: Skype IM Problem

diennea — Thu, 08 Nov 2012 15:59:16 GMT

No: I were suggesting it could be solved with this new version 337 released yesterday (I apologize for my English)

The problem occurs for several weeks

Re: Skype IM Problem

essnet — Thu, 08 Nov 2012 16:02:43 GMT

Well yes you should try new signature, especially if it says Skype signature was updated.

My advice would be to forbid Skype on your network anyway : it's peer to peer, encrypted (so anti virus/vulnerability cannot do its job), its code was accessed by many many developpers/hackers over the years/buyouts . to make it short, it's all but secure or 'securable'.

Re: Skype IM Problem

diennea — Thu, 08 Nov 2012 16:28:46 GMT

I cannot.... Too many customers use it... So we need Skype...

Re: Skype IM Problem

essnet — Thu, 08 Nov 2012 17:03:40 GMT

Then I advice you to add 'unknown-tcp' when customers start complaining until PA releases a fix.

I have another application that is creating me such problems, 4 or 5 times per year the protocol changes a bit and PAN releases a fix after a few weeks, during that time I have no other choice than allow unkown-tcp until the fix is there.

Re: Skype IM Problem

mikand — Thu, 08 Nov 2012 20:52:41 GMT

Yes but the signature could for example be something like (just guessing but as an example):

If skype-probe detected using dstip X and dstport Y and unknown-tcp shows up within Z minutes of initial connection towards the same dstip and dstport identify this as skype-message else identify as unknown-tcp.

Re: Skype IM Problem

essnet — Thu, 08 Nov 2012 20:56:45 GMT

That would mean you can trick PANOS : want to use forbidden software at work ? run Skype at the same time and it will be classified as armless connections.

Re: Skype IM Problem

mikand — Thu, 08 Nov 2012 21:06:56 GMT

Well unless PA broke the private keys of Skype thats the security problem you will face if you choose to allow Skype to traverse through your network and into the Internet.

Simply because Skype uses encryption and various ways to avoid being detected. For example not using a static ssl certificate or such.

Same goes with windowsupdate which is a similar problem. But in this case windowsupdate uses dedicated server certificates which if the ssl doesnt match the client will refuse to download anything from the ssl terminated server.

Re: Skype IM Problem

cryptochrome — Tue, 27 Nov 2012 13:10:10 GMT

Now here is something strange for you all to wrap your head around: I have the very same problem, but in my case, all communication is allowed (there is a any-allow rule). Messages can't be sent, sometimes they have the status "pending" for forever (while the destination actually receives the message), replies don't come back.

Re: Skype IM Problem

mikand — Tue, 27 Nov 2012 14:04:47 GMT

and you have ssl decrypt running in ssl-proxy mode and block those ssl sessions which cannot be decrypted for inspection?